Bug 200732 - (CVE-2006-3918) CVE-2006-3918 httpd: Expect header XSS
CVE-2006-3918 httpd: Expect header XSS
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Joe Orton
public=20060508,source=asf,impact=mod...
: Reopened, Security
Depends On: 413891 449336 430780 430781 430782 582767
Blocks:
  Show dependency treegraph
 
Reported: 2006-07-31 08:49 EDT by Mark J. Cox (Product Security)
Modified: 2016-03-04 05:59 EST (History)
2 users (show)

See Also:
Fixed In Version: httpd 1.3.35
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-04-04 19:12:09 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Mark J. Cox (Product Security) 2006-07-31 08:49:33 EDT
In May 2006 a reporter found a bug in Apache where an invalid Expect header sent
to the server (Apache 1.3.3 onwards) would be returned to the user in an error
message, unescaped.  This could allow a cross-site scripting attack only if a
victim can tricked into connecting to a site and sending such a carefully
crafted Expect header.  Whist browsers do not provide this functionality, it was
recently discovered that Flash allows you to make a connection with arbitrary
headers.  The attack mechanism is therefore:

1. User is tricked into visiting a malicious web site with a flash-enabled browser
2. Malicious web site uses a flash movie to make a connection to the target site
with custom Expect header
3. This results in cross-site scripting (attacker could steal your cookies from
the third party site, or inject content etc)

Note that this also affects RHEL2.1, and RHEL3.

On RHEL3 and RHEL4 the cross-site scripting does not happen immediately, step 3
is delayed until the Apache server times out.  On a default installation this
could be 2-5 minutes.  Therefore the attack is less likely to succeed.

Patch:
http://svn.apache.org/viewcvs?rev=394965&view=rev [1.3]
http://svn.apache.org/viewcvs?rev=395172&view=rev [2.0]
Comment 3 Joe Orton 2007-06-01 06:13:09 EDT
Fixed in errata: http://rhn.redhat.com/errata/RHSA-2006-0619.html
Comment 8 errata-xmlrpc 2010-08-04 17:31:22 EDT
This issue has been addressed in following products:

  Red Hat Certificate System 7.3

Via RHSA-2010:0602 https://rhn.redhat.com/errata/RHSA-2010-0602.html
Comment 9 Vincent Danen 2013-04-04 19:12:09 EDT
This was fixed previously in these Red Hat products:

Red Hat Certificate System 7.3 for 4AS: RHSA-2010:0602
Red Hat Enterprise Linux version 2.1: RHSA-2006:0618
Red Hat Enterprise Linux version 3: RHSA-2006:0619
Red Hat Enterprise Linux version 4: RHSA-2006:0619
Red Hat Network Proxy v 4.2 (RHEL v.3 AS): RHSA-2008:0523
Red Hat Network Proxy v 4.2 (RHEL v.4 AS): RHSA-2008:0523
Stronghold 4 for Red Hat Enterprise Linux: RHSA-2006:0692

Note You need to log in before you can comment on or make changes to this bug.